Cookies, plainly.

01. What is a cookie?

A cookie is a small text file stored in your browser when you visit a site. WhatOTP only uses first-party cookies; no advertising, analytics, social media or third-party tracking cookies are used. Fonts are served from our own server. This policy forms part of the Privacy Policy.

02. Strictly necessary cookies

whatotp_session: keeps you signed in; readable only by the server (HttpOnly), 30 days.

whatotp_oauth and whatotp_oauth_locale: securely complete Google/GitHub sign-in and return you to the right language, 10 minutes.

whatotp_device: a random device identifier created at registration, used to prevent many accounts being opened from the same browser and abuse of the free quota. Readable only by the server; only a keyed hash is stored in the database, 2 years.

whatotp_consent: remembers your cookie choice, 6 months.

These cookies are required for the service to work securely; they are processed under KVKK Art. 5/2-c and f, need no explicit consent and cannot be turned off.

03. Preference cookies

whatotp_locale: remembers your language and sends you to it when you open the home page, 1 year. It is only stored if you give explicit consent with “Accept all” (KVKK Art. 5/1).

04. Bot check (Cloudflare Turnstile)

On registration and some account forms, Cloudflare Turnstile is loaded to prevent automated signups. Turnstile may send browser and device signals and your IP address to Cloudflare to perform the check; this is governed by Cloudflare's privacy policy and Cloudflare's servers may be located abroad. Turnstile is not used for advertising or cross-site tracking and loads only when these forms are opened.

05. Change your choice

Use the “Cookie preferences” link in the footer to change your choice at any time; choosing “Essential only” deletes the preference cookie. You can also delete or block cookies in your browser settings; deleting essential cookies signs you out and some features (sign-in, registration) may not work.